The ERO Enterprise recommitted itself to adapting to meet its growing challenges in 2021, including the ongoing COVID-19 pandemic, climate change and cybersecurity, NERC said in its annual report released Wednesday.

NERC CEO Jim Robb wrote in the report that the previous two years have “brought significant clarity” to the cyber and climate risks, with both vividly on display in 2021. The year was bookended by the discovery of major electronic supply chain security breaches, with the SolarWinds Orion compromise coming to light in December 2020 and the Apache Log4j vulnerability identified a year later; meanwhile, the massive outages in Texas caused by February’s severe winter storms illustrated the danger facing the current electric grid under rapidly shifting climate patterns.

“We are at a historic moment,” Robb said. “Our model was developed during a time when risks were well known and the grid was evolving at a measured pace. We are now in a time where significant risks are emerging; they are new and unfamiliar; and the grid is transforming at a significant pace.”

Transformation was a major theme of the report, both as it relates to the grid’s transition to new energy sources and digital control, and concerning the organization of the ERO Enterprise itself. For the latter NERC noted the launch of its “NERC 2.0 – Invented Future” initiative in 2021, the name of which “recognizes that … NERC employees have the opportunity to innovate and create the future they want to have for themselves every day.”

The initiative comprises a new flexible work model that gives employees more freedom to work remotely — inspired in part by the experience of the COVID-19 pandemic — as well as new training that encourages employees to take on leadership roles. NERC also created the post of vice president of people and culture to oversee the initiative; the first and current holder of the role is Bryan Preston, who joined the organization in September. (See “Trustees Re-elected; Leadership Shuffle at MRC, Board Committees,” NERC Board of Trustees/MRC Briefs: Feb. 10, 2022.)

For the grid transformation, the report observed that “the past year has seen the manifestation” of multiple risks relating to “the transition to a cleaner energy future,” meaning the replacement of conventional generation resources with renewables like wind and solar, along with the growth of distributed energy resources.

First is extreme weather: Much of the report is dedicated to NERC’s actions over the past year to prevent another near-breakdown of the grid like what nearly happened in Texas. (See ERCOT: Grid was ‘Seconds and Minutes’ from Total Collapse.) Those efforts include accelerating approval of the cold weather standard that was under development before the storm; initiating work on a new standard inspired by the recommendations from FERC and NERC’s joint inquiry on the storm; and NERC’s outreach to industry to encourage preparedness ahead of the current winter season.

The other major risk that the report points out is cybersecurity, particularly the supply chain risks highlighted by the SolarWinds and Log4j compromises, but also the potential weaknesses in the nation’s pipeline infrastructure exposed by the Colonial Pipeline ransomware attack in May. (See Colonial CEO Welcomes Federal Cyber Assistance.)

NERC observed that the industry has grown more reliant on remote work because of the pandemic, creating “an increased remote cybersecurity attack surface” that, coupled with known weaknesses in widely used software, gives potential attackers myriad opportunities to infiltrate critical systems. The organization called for itself and the industry to “maintain a continued focus on improving defenses by increased sharing with” the Electricity Information Sharing and Analysis Center.

NERC Board of Trustees Chair Ken DeFontes warned that “significant policy and technical forces” are driving change in the grid, and that “these changes are occurring at a rapid pace.” He said that the board’s three top priorities for 2021 — weatherization, energy reliability assurance and cybersecurity — will likely remain at the top of the organization’s mind “for some time.”

“The more complex the system becomes, the greater the risk to reliability, resilience and security. At the same time, the future offers exciting new opportunities and transitions for an industry that is amazingly adaptive to change,” DeFontes said. “I look forward to working with all of our stakeholders and policymakers as we rededicate and reorient ourselves to meeting these challenges.”